A critical SQL injection vulnerability in ChurchCRM versions prior to 7.1.0 allows authenticated attackers to compromise the integrity and confidentiality of the underlying database.

The flaw is an SQL injection (CWE-89) located in the PropertyTypeEditor.php endpoint. It allows an authenticated user with the isMenuOptionsEnabled role to inject arbitrary SQL commands through the Name and Description parameters.

This vulnerability carries a CVSS score of 8.8, reflecting its high potential for full database compromise. Successful exploitation could lead to the unauthorized disclosure, modification, or deletion of sensitive church member data, potentially resulting in significant reputational damage and operational disruption.

Immediate Action: Upgrade your ChurchCRM instance to version 7.1.0 or later to apply the necessary security patches.

Proactive Monitoring: Review database audit logs for anomalous query patterns, particularly those originating from the PropertyTypeEditor.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting input parameters.

Public Exploit Available: Unknown.

Given the high CVSS score and the confirmed existence of proof-of-concept material, administrators should prioritize this update immediately. Ensure that access controls are strictly enforced and that only authorized personnel maintain the isMenuOptionsEnabled capability until the patch is successfully deployed.